@openclaw/openshell-sandbox 2026.10.2 → 2026.10.5-beta.2

package/node_modules/@openclaw/fs-safe/dist/copy-root-file-sync.d.ts

@@ -1,9 +1,6 @@
+import { type CopyPath } from "./copy-path-admission.js";
 import { type CopyCloneMode } from "./copy-policy.js";
 import { type OwnedFileDescriptorSync } from "./create-owned-file.js";
-type CopyPath = {
-    rootPath: string;
-    absolutePath: string;
-};
 export type CopyRootFileSyncOptions = {
     source: CopyPath;
     destination: CopyPath;
@@ -32,4 +29,10 @@ export type CopiedRootFileSync = OwnedFileDescriptorSync & Readonly<{
 }>;
 /** Exclusively copies an admitted source and transfers the owned destination fd. */
 export declare function copyRootFileSync(options: CopyRootFileSyncOptions): CopiedRootFileSync;
-export {};
+export type RootFileCopyBatchSync = {
+    copyFile(options: CopyRootFileSyncOptions): CopiedRootFileSync;
+    close(): void;
+    [Symbol.dispose](): void;
+};
+/** Reuses directory admissions while retaining fresh checks for every copy. */
+export declare function createRootFileCopyBatchSync(): RootFileCopyBatchSync;

package/node_modules/@openclaw/fs-safe/dist/copy-root-file-sync.js

@@ -1,19 +1,17 @@
 import fs, {} from "node:fs";
 import path from "node:path";
 import { normalizeMaxBytes } from "./byte-budget.js";
+import { createCopyPathAdmissionCache } from "./copy-path-admission.js";
 import { resolveCopyCloneMode } from "./copy-policy.js";
 import { createFileWithAdmissionSync } from "./create.js";
 import { ownFileDescriptorSync } from "./create-owned-file.js";
 import { creationAdmissionFromParent, removeRecordedCreationFileSync } from "./creation-boundary.js";
-import { assertSyncDirectoryGuard, captureDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { assertExclusiveCreateLeaf } from "./exclusive-create.js";
 import { copyFileDescriptorSync } from "./file-handle-transfer.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { getNativeBinding } from "./native.js";
-import { realpathSync } from "./realpath.js";
 import { openRootFileSync } from "./root-file.js";
-import { resolveRootPathSync, ROOT_PATH_ALIAS_POLICIES } from "./root-path.js";
 import { inspectOpenedPathIdentitySync } from "./root-read-admission.js";
 import { openStagedDirectory } from "./staged-directory.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
@@ -26,42 +24,26 @@ function copyError(error) {
             ["ENOTSUP", "EOPNOTSUPP", "ENOSYS", "EXDEV", "EINVAL"].includes(code ?? "")
                 ? "unsupported-platform" : "helper-failed", "guarded synchronous file copy failed", { cause: error });
 }
-function admitCopyPath(input, create = false) {
-    if (!path.isAbsolute(input.rootPath) || !path.isAbsolute(input.absolutePath)) {
-        throw new FsSafeError("invalid-path", "copy roots and paths must be absolute");
-    }
-    const root = captureDirectoryGuard(realpathSync(input.rootPath), "native", { bigint: true });
-    const resolve = () => {
-        const parent = create ? resolveRootPathSync({
-            ...input, absolutePath: path.dirname(input.absolutePath), boundaryLabel: "copy parent",
-            rejectSymlinks: true, rejectFinalSymlink: true,
-        }) : undefined;
-        const selected = resolveRootPathSync({
-            ...input, boundaryLabel: "copy", rejectSymlinks: !create, rejectFinalSymlink: !create,
-            policy: create ? ROOT_PATH_ALIAS_POLICIES.unlinkTarget : undefined,
-        });
-        if (parent && path.dirname(selected.canonicalPath) !== parent.canonicalPath) {
-            throw new FsSafeError("path-mismatch", "copy destination parent changed");
-        }
-        return selected;
-    };
-    const selected = resolve();
-    const parent = captureDirectoryGuard(path.dirname(selected.canonicalPath), "native", { bigint: true });
-    const assertCurrent = () => {
-        assertSyncDirectoryGuard(root);
-        assertSyncDirectoryGuard(parent);
-        const current = resolve();
-        if (current.rootCanonicalPath !== root.realPath || current.canonicalPath !== selected.canonicalPath) {
-            throw new FsSafeError("path-mismatch", "copy path changed during operation");
-        }
-        assertSyncDirectoryGuard(root);
-        assertSyncDirectoryGuard(parent);
-    };
-    assertCurrent();
-    return { path: selected.canonicalPath, parent, assertCurrent };
-}
 /** Exclusively copies an admitted source and transfers the owned destination fd. */
 export function copyRootFileSync(options) {
+    return copyRootFileWithAdmissionSync(options, createCopyPathAdmissionCache());
+}
+/** Reuses directory admissions while retaining fresh checks for every copy. */
+export function createRootFileCopyBatchSync() {
+    const cache = createCopyPathAdmissionCache();
+    let closed = false;
+    const close = () => { closed = true; cache.clear(); };
+    return Object.freeze({
+        copyFile(options) {
+            if (closed)
+                throw new FsSafeError("invalid-path", "copy batch is closed");
+            return copyRootFileWithAdmissionSync(options, cache);
+        },
+        close,
+        [Symbol.dispose]: close,
+    });
+}
+function copyRootFileWithAdmissionSync(options, cache) {
     // Snapshot caller options before the first filesystem observation.
     const sourceInput = options.source;
     const sourcePath = { rootPath: sourceInput.rootPath, absolutePath: sourceInput.absolutePath };
@@ -89,17 +71,16 @@ export function copyRootFileSync(options) {
     const native = getNativeBinding();
     const nativeCopy = process.platform !== "win32" && native?.copyFileExclusiveSync && native.removeStagedFile
         ? native.copyFileExclusiveSync.bind(native) : undefined;
-    let nativeTarget = false;
     try {
-        const source = admitCopyPath(sourcePath);
-        target = admitCopyPath(targetPath, true);
+        const source = cache.admit(sourcePath);
+        target = cache.admit(targetPath, true);
         // Preserve exclusive-create collision semantics for dangling Windows leaves.
         assertExclusiveCreateLeaf(targetPath.absolutePath);
         if (fs.lstatSync(target.path, { throwIfNoEntry: false })) {
             throw new FsSafeError("already-exists", "copy destination already exists");
         }
         const opened = openRootFileSync({
-            ...sourcePath, boundaryLabel: "copy source", maxBytes,
+            ...sourcePath, rootRealPath: source.rootCanonicalPath, boundaryLabel: "copy source", maxBytes,
             rejectHardlinks: sourceHardlinks !== "allow",
         });
         if (!opened.ok)
@@ -121,7 +102,6 @@ export function copyRootFileSync(options) {
             }
         };
         const selectedMode = mode ?? (preserveSourceMode ? Number(sourceIdentity.mode & 511n) : 0o600 & ~process.umask());
-        let method = "copy";
         let copied;
         verifySource();
         target.assertCurrent();
@@ -134,7 +114,6 @@ export function copyRootFileSync(options) {
             target.assertCurrent();
             copied = nativeCopy(opened.fd, parent.fd, path.basename(target.path), clone, maxBytes !== undefined && Number.isFinite(maxBytes) ? maxBytes : undefined);
             targetOwner = ownFileDescriptorSync(copied.fd, closeNative);
-            nativeTarget = true;
         }
         else {
             if (clone === "always")
@@ -155,13 +134,11 @@ export function copyRootFileSync(options) {
         if (copied?.errorCode) {
             throw copyError(Object.assign(new Error(copied.errorMessage), { code: copied.errorCode }));
         }
-        if (copied) {
-            if (!["clone", "copy-file-range", "copy"].includes(copied.method)) {
-                throw new FsSafeError("helper-failed", "native copy returned an unknown method");
-            }
-            method = copied.method;
+        const method = copied ? copied.method : "copy";
+        if (method !== "clone" && method !== "copy-file-range" && method !== "copy") {
+            throw new FsSafeError("helper-failed", "native copy returned an unknown method");
         }
-        else {
+        if (!copied) {
             copyFileDescriptorSync(opened.fd, targetOwner.fd, { maxBytes });
         }
         verifySource();
@@ -186,7 +163,7 @@ export function copyRootFileSync(options) {
         const cleanup = [];
         if (targetOwner && target) {
             try {
-                if (nativeTarget && parentOpen) {
+                if (parentOpen) {
                     const removed = native.removeStagedFile(parentOwner.fd, path.basename(target.path), targetOwner.fd);
                     if (removed === "preserved")
                         throw new FsSafeError("path-mismatch", "copy cleanup preserved a replacement");

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-acquire.d.ts

@@ -1,3 +1,6 @@
 import type { FileLockSyncAcquireOptions, FileLockSyncHandle } from "./file-lock-sync.js";
 import type { Root } from "./root-impl.js";
+import { type FileLockSyncRootPath } from "./file-lock-sync-root.js";
+import { type FileLockSyncRootFileReceipt } from "./file-lock-sync-root-io.js";
+export declare function cleanupCreatedRootSyncLock(lockRootPath: FileLockSyncRootPath, fd: number, receipt: FileLockSyncRootFileReceipt, timer?: NodeJS.Timeout): void;
 export declare function acquireFileLockSyncWithRoot<TPayload extends Record<string, unknown>>(targetPath: string, inputOptions: FileLockSyncAcquireOptions<TPayload>, lockRoot: Root): FileLockSyncHandle;

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-acquire.js

@@ -10,10 +10,40 @@ import { SyncLockAcquisition } from "./file-lock-sync-acquisition.js";
 import { assertSynchronousCallbackResult } from "./mutation-authority.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 import { admitFileLockSyncRootPath, assertFileLockSyncRootPathsCurrent, captureFileLockSyncRootAuthority, normalizeFileLockSyncTargetWithRoot, } from "./file-lock-sync-root.js";
-import { cleanupCreatedRootSyncLock, FileLockSyncRootArbitrationCollision, tryReuseCurrentRootSyncHeldLock, } from "./file-lock-sync-root-arbitration.js";
 import { fileLockSyncRootSnapshotStillCurrent, } from "./file-lock-sync-root-io.js";
 import { createFileLockSyncRootDirectory, createFileLockSyncRootFile, fileLockSyncRootGuardExists, fileLockSyncRootDirectoryReceiptStillCurrent, refreshFileLockSyncRootFileReceipt, removeFileLockSyncRootDirectory, removeFileLockSyncRootFile, } from "./file-lock-sync-root-mutation.js";
-import { createRootSyncHeldLockHandle, ensureRootSyncExitCleanupRegistered, getRootSyncHeldLocks, readRootSidecarSnapshotSync, } from "./file-lock-sync-root-held.js";
+import { createRootSyncHeldLockHandle, ensureRootSyncExitCleanupRegistered, getRootSyncHeldLocks, readRootSidecarSnapshotSync, verifyRootSyncHeldLock, } from "./file-lock-sync-root-held.js";
+class FileLockSyncRootArbitrationCollision extends FsSafeError {
+    constructor() {
+        super("path-mismatch", "file lock arbitration changed during local creation");
+    }
+}
+export function cleanupCreatedRootSyncLock(lockRootPath, fd, receipt, timer) {
+    let timerCleanupFailed = false;
+    let timerCleanupError;
+    try {
+        if (timer)
+            clearInterval(timer);
+    }
+    catch (error) {
+        timerCleanupFailed = true;
+        timerCleanupError = error;
+    }
+    try {
+        fs.closeSync(fd);
+        if (!removeFileLockSyncRootFile(lockRootPath, receipt)) {
+            throw new FsSafeError("path-mismatch", "created sidecar lock changed before cleanup");
+        }
+    }
+    catch (fileCleanupError) {
+        if (timerCleanupFailed) {
+            throw createSuppressedError(timerCleanupError, fileCleanupError, "unpublished lock timer and file cleanup both failed");
+        }
+        throw fileCleanupError;
+    }
+    if (timerCleanupFailed)
+        throw timerCleanupError;
+}
 export function acquireFileLockSyncWithRoot(targetPath, inputOptions, lockRoot) {
     // The public dispatcher already read lockRoot exactly once. Validate and
     // snapshot that genuine Root before any remaining option or retry getter can
@@ -37,23 +67,39 @@ export function acquireFileLockSyncWithRoot(targetPath, inputOptions, lockRoot)
     const heldLocks = getRootSyncHeldLocks();
     const currentTargetHolder = () => heldLocks.get(normalizedTargetPath) ??
         foreignSyncHeldLock("root", normalizedTargetPath);
-    const arbitration = Object.freeze({
-        authority,
-        heldLocks,
-        lockRootPath,
-        normalizedTargetPath,
-        reentrantOwner: options.reentrantOwner,
-    });
+    const tryReuseCurrentHeld = () => {
+        const held = heldLocks.get(normalizedTargetPath);
+        const reusable = held && !foreignSyncHeldLock("root", normalizedTargetPath) &&
+            options.reentrantOwner !== undefined && held.reentrantOwner !== undefined &&
+            options.reentrantOwner === held.reentrantOwner &&
+            authority.adapter === held.rootAuthority.adapter &&
+            lockRootPath.relativePath === held.rootPath.relativePath &&
+            path.relative(lockRootPath.path, held.rootPath.path) === "" &&
+            held.releaseState !== "released";
+        if (!reusable)
+            return undefined;
+        if (!verifyRootSyncHeldLock(held)) {
+            throw new FsSafeError("path-mismatch", "held sidecar lock changed before reentrant reuse");
+        }
+        // The parser can reenter acquisition; recheck the exact held entry before reuse.
+        if (heldLocks.get(normalizedTargetPath) !== held || held.releaseState === "released" ||
+            foreignSyncHeldLock("root", normalizedTargetPath)) {
+            throw new FsSafeError("path-mismatch", "held sidecar lock changed during reentrant reuse");
+        }
+        held.refCount += 1;
+        held.revision += 1;
+        return createRootSyncHeldLockHandle(held);
+    };
     if (heldLocks.has(normalizedTargetPath) && !foreignSyncHeldLock("root", normalizedTargetPath)) {
         assertFileLockSyncRootPathsCurrent(guardedPaths);
-        const initiallyReusable = tryReuseCurrentRootSyncHeldLock(arbitration);
+        const initiallyReusable = tryReuseCurrentHeld();
         if (initiallyReusable)
             return initiallyReusable;
     }
     const acquisition = new SyncLockAcquisition(lockPath, normalizedTargetPath, options.retry, options.timeoutMs);
     let ownedReclaimGuard;
     let reclaimCleanupAttempted = false;
-    const reuseCurrentHeld = () => ownedReclaimGuard ? undefined : tryReuseCurrentRootSyncHeldLock(arbitration);
+    const reuseCurrentHeld = () => ownedReclaimGuard ? undefined : tryReuseCurrentHeld();
     const releaseReclaimGuard = () => {
         const receipt = ownedReclaimGuard;
         if (!receipt)

package/node_modules/@openclaw/fs-safe/dist/guarded-mutation.js

@@ -1,16 +1,16 @@
 import fsSync, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { assertAsyncDirectoryGuard, assertSyncDirectoryGuard, createAsyncDirectoryGuard, createSyncDirectoryGuard, } from "./directory-guard.js";
+import { assertDirectoryGuard, assertSyncDirectoryGuard, createAsyncDirectoryGuard, createSyncDirectoryGuard, } from "./directory-guard.js";
 export async function withAsyncDirectoryGuards(guards, mutate, options = {}) {
     for (const guard of guards) {
-        await assertAsyncDirectoryGuard(guard);
+        assertDirectoryGuard(guard, "native");
     }
     const result = await mutate();
     if (options.verifyAfter !== false) {
         try {
             for (const guard of guards) {
-                await assertAsyncDirectoryGuard(guard);
+                assertDirectoryGuard(guard, "native");
             }
         }
         catch (error) {
@@ -46,11 +46,11 @@ export async function guardedRename(params) {
     const sourceGuard = await createAsyncDirectoryGuard(path.dirname(params.from));
     const targetGuard = await createAsyncDirectoryGuard(path.dirname(params.to));
     await withAsyncDirectoryGuards([sourceGuard, targetGuard], async () => {
+        // Authority must survive all awaited guards; do not yield before rename dispatch.
+        params.assertBeforeRename?.();
         if (params.onSourceInspected) {
             params.onSourceInspected(fsSync.lstatSync(params.from, { bigint: true }));
         }
-        // Authority must survive all awaited guards; do not yield before rename dispatch.
-        params.assertBeforeRename?.();
         await fs.rename(params.from, params.to);
         params.onRenamed?.();
     });

package/node_modules/@openclaw/fs-safe/dist/guest-native-python.js

@@ -32,6 +32,16 @@ export const GUEST_FILESYSTEM_CREATE_STAGING_PYTHON = [
 ].join("\n");
 export const GUEST_FILESYSTEM_RENAME_NO_REPLACE_PYTHON = [
     "def rename_no_replace(src_parent_fd, src_basename, dst_parent_fd, dst_basename):",
+    "    import stat",
+    "    source = os.lstat(src_basename, dir_fd=src_parent_fd)",
+    "    kind = stat.S_IFMT(source.st_mode)",
+    "    expected = (source.st_dev, source.st_ino, kind)",
+    "    def verify(parent_fd, basename, links):",
+    "        current = os.lstat(basename, dir_fd=parent_fd)",
+    "        if (current.st_dev, current.st_ino, stat.S_IFMT(current.st_mode)) != expected:",
+    "            raise OSError(errno.ESTALE, 'no-replace publication identity changed', basename)",
+    "        if kind == stat.S_IFREG and current.st_nlink != links:",
+    "            raise OSError(errno.ESTALE, 'no-replace publication link count changed', basename)",
     "    libc = ctypes.CDLL(None, use_errno=True)",
     "    is_linux = sys.platform.startswith('linux')",
     "    if is_linux:",
@@ -62,6 +72,31 @@ export const GUEST_FILESYSTEM_RENAME_NO_REPLACE_PYTHON = [
     "            raise OSError(error_code, os.strerror(error_code), dst_basename)",
     "    elif not is_linux:",
     "        raise OSError(errno.ENOSYS, 'atomic no-replace rename is unavailable')",
+    "    # Only a definitive rejection of the fixed flags reaches this fallback.",
+    "    if kind not in (stat.S_IFDIR, stat.S_IFREG):",
+    "        raise OSError(errno.EINVAL, 'no-replace fallback requires a file or directory', src_basename)",
+    "    verify(src_parent_fd, src_basename, 1)",
+    "    try:",
+    "        os.lstat(dst_basename, dir_fd=dst_parent_fd)",
+    "    except FileNotFoundError:",
+    "        pass",
+    "    else:",
+    "        raise FileExistsError(errno.EEXIST, os.strerror(errno.EEXIST), dst_basename)",
+    "    if kind == stat.S_IFDIR:",
+    "        verify(src_parent_fd, src_basename, 1)",
+    "        # A directory rename can replace only an EMPTY directory raced into",
+    "        # the absent target. Non-empty directories and files are refused.",
+    "        # The slash enforces source directory type at the syscall, even if",
+    "        # a peer substitutes a file/symlink after verification. Identity",
+    "        # checks are not compare-and-swap; verify publication afterward.",
+    "        try:",
+    "            os.rename(src_basename + '/', dst_basename, src_dir_fd=src_parent_fd, dst_dir_fd=dst_parent_fd)",
+    "        except OSError as error:",
+    "            if error.errno in (errno.ENOTEMPTY, errno.ENOTDIR, errno.EEXIST):",
+    "                raise FileExistsError(errno.EEXIST, os.strerror(errno.EEXIST), dst_basename) from error",
+    "            raise",
+    "        verify(dst_parent_fd, dst_basename, 1)",
+    "        return",
     "    os.link(",
     "        src_basename,",
     "        dst_basename,",
@@ -69,12 +104,19 @@ export const GUEST_FILESYSTEM_RENAME_NO_REPLACE_PYTHON = [
     "        dst_dir_fd=dst_parent_fd,",
     "        follow_symlinks=False,",
     "    )",
+    "    # Only this exact two-name interval permits nlink=2. Never roll back the",
+    "    # target on failure: it may be the only remaining link to the source.",
+    "    verify(dst_parent_fd, dst_basename, 2)",
+    "    verify(src_parent_fd, src_basename, 2)",
+    "    os.unlink(src_basename, dir_fd=src_parent_fd)",
+    "    verify(dst_parent_fd, dst_basename, 1)",
 ].join("\n");
 export const GUEST_FILESYSTEM_CREATE_EXCLUSIVE_PYTHON = [
     "def create_exclusive(parent_fd, basename, stdin_buffer):",
     "    staging_fd = None",
     "    staging_name = None",
     "    temp_fd = None",
+    "    temp_inode = None",
     "    temp_name = 'payload'",
     "    try:",
     "        try:",
@@ -85,6 +127,7 @@ export const GUEST_FILESYSTEM_CREATE_EXCLUSIVE_PYTHON = [
     "            raise FileExistsError(errno.EEXIST, os.strerror(errno.EEXIST), basename)",
     "        staging_name, staging_fd = create_staging_dir(parent_fd)",
     "        temp_fd = os.open(temp_name, WRITE_FLAGS, 0o600, dir_fd=staging_fd)",
+    "        temp_inode = inode_identity(os.fstat(temp_fd))",
     "        while True:",
     "            chunk = stdin_buffer.read(65536)",
     "            if not chunk:",
@@ -92,8 +135,7 @@ export const GUEST_FILESYSTEM_CREATE_EXCLUSIVE_PYTHON = [
     "            write_all(temp_fd, chunk)",
     "        # exclusive create payload is durable before publication",
     "        os.fsync(temp_fd)",
-    "        temp_inode = inode_identity(os.fstat(temp_fd))",
-    "        # Publish with a native atomic no-replace rename.",
+    "        # Publish with no-replace rename or the checked file fallback.",
     "        rename_no_replace(staging_fd, temp_name, parent_fd, basename)",
     "        target_stat = os.lstat(basename, dir_fd=parent_fd)",
     "        if temp_inode != inode_identity(target_stat):",
@@ -105,14 +147,19 @@ export const GUEST_FILESYSTEM_CREATE_EXCLUSIVE_PYTHON = [
     "        if staging_fd is not None:",
     "            # Cleanup stays relative to the private pinned directory, so a",
     "            # parent-path substitution cannot redirect payload deletion.",
+    "            payload_removed = False",
     "            try:",
-    "                os.unlink(temp_name, dir_fd=staging_fd)",
+    "                current_payload = os.lstat(temp_name, dir_fd=staging_fd)",
+    "                # Preserve ambiguous or partially published link pairs.",
+    "                if temp_inode == inode_identity(current_payload) and current_payload.st_nlink == 1:",
+    "                    os.unlink(temp_name, dir_fd=staging_fd)",
+    "                    payload_removed = True",
     "            except FileNotFoundError:",
-    "                pass",
+    "                payload_removed = True",
     "            staging_identity = entry_identity(os.fstat(staging_fd))",
     "            os.close(staging_fd)",
     "            staging_removed = False",
-    "            if staging_name is not None:",
+    "            if staging_name is not None and payload_removed:",
     "                try:",
     "                    current_staging = os.lstat(staging_name, dir_fd=parent_fd)",
     "                    if same_identity(staging_identity, current_staging):",

package/node_modules/@openclaw/fs-safe/dist/guest.js

@@ -395,7 +395,7 @@ export const GUEST_FILESYSTEM_PYTHON = [
     "                break",
     "            write_all(temp_fd, chunk)",
     "        try:",
-    "            os.fchmod(temp_fd, stat.S_IMODE(src_stat.st_mode))",
+    "            os.fchmod(temp_fd, stat.S_IMODE(src_file_stat.st_mode))",
     "        except AttributeError:",
     "            pass",
     "        os.fsync(temp_fd)",

package/node_modules/@openclaw/fs-safe/dist/native-binding.d.ts

@@ -139,6 +139,7 @@ export interface NativeBinding {
     renameReplaceWithIdentity?(sourceParent: number, source: string, targetParent: number, target: string, dev: bigint, ino: bigint): void;
     /** Windows-only, private handle custody; no borrowed/runtime descriptors. */
     retainWindowsFile?(directory: string, basename: string, parentDev: bigint, parentIno: bigint, dev: bigint, ino: bigint, size: bigint, mtimeNs: bigint, ctimeNs: bigint, sha256: string, maxBytes: number): NativeRetainedFile;
+    retainWindowsSidecar?(parentFd: number, directory: string, basename: string, parentDev: bigint, parentIno: bigint, dev: bigint, ino: bigint, size: bigint, sha256: string, maxBytes: number): NativeRetainedFile;
     watchRegister?(root: string, limit: number, callback: (batch: import("./watch-native.js").NativeWatchWireBatch) => void, persistent: boolean): number;
     watchConfigure?(id: number, anchors: string[], exclusions: string[]): void;
     watchEntries?(id: number, entries: import("./watch-native.js").NativeWatchEntry[]): {

package/node_modules/@openclaw/fs-safe/dist/native-operations.d.ts

@@ -5,7 +5,6 @@ export type NativeFileHandle = {
     writeFile(data: string | Buffer, encoding?: BufferEncoding): Promise<void>;
 };
 export declare function nativeOpenFlags(flags: number): number;
-export declare function writeNativeFd(fd: number, data: Buffer): void;
 export declare function removeNativeCreatedFileIfStillPinned(params: {
     parentPath: string;
     parentFd: number;

package/node_modules/@openclaw/fs-safe/dist/native-operations.js

@@ -10,31 +10,6 @@ export function nativeOpenFlags(flags) {
         (closeOnExec ?? 0) |
         (typeof fsSync.constants.O_NOFOLLOW === "number" ? fsSync.constants.O_NOFOLLOW : 0));
 }
-export function writeNativeFd(fd, data) {
-    let offset = 0;
-    while (offset < data.byteLength) {
-        const written = fsSync.writeSync(fd, data, offset, data.byteLength - offset);
-        if (written <= 0) {
-            throw Object.assign(new Error("native file write made no progress"), { code: "EIO" });
-        }
-        offset += written;
-    }
-}
-function wrapNativeFd(fd, closeFd) {
-    let open = true;
-    return {
-        fd,
-        async close() {
-            if (open) {
-                open = false;
-                closeFd(fd);
-            }
-        },
-        async writeFile(data, encoding) {
-            writeNativeFd(fd, Buffer.isBuffer(data) ? data : Buffer.from(data, encoding ?? "utf8"));
-        },
-    };
-}
 export function removeNativeCreatedFileIfStillPinned(params) {
     if (!params.created) {
         return;
@@ -86,7 +61,28 @@ export async function createNativeExclusiveFile(targetPath, mode) {
         fd = opened.fd;
         fsSync.fchmodSync(fd, mode);
         created = fsSync.fstatSync(fd, { bigint: true });
-        return wrapNativeFd(fd, closeFd);
+        const ownedFd = fd;
+        let open = true;
+        return {
+            fd: ownedFd,
+            async close() {
+                if (open) {
+                    open = false;
+                    closeFd(ownedFd);
+                }
+            },
+            async writeFile(data, encoding) {
+                const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data, encoding ?? "utf8");
+                let offset = 0;
+                while (offset < buffer.byteLength) {
+                    const written = fsSync.writeSync(ownedFd, buffer, offset, buffer.byteLength - offset);
+                    if (written <= 0) {
+                        throw Object.assign(new Error("native file write made no progress"), { code: "EIO" });
+                    }
+                    offset += written;
+                }
+            },
+        };
     }
     catch (error) {
         if (fd !== undefined) {

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write-windows.js

@@ -188,7 +188,11 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
         if (params.sync !== false)
             syncFileBestEffortSync(parentFd);
         // Verification follows publication and final chmod, outside rollback handling.
-        await params.verifyPublished?.(targetFd, verificationIdentity, parentGuard);
+        if (params.overwrite === false && params.input.kind === "buffer" && params.input.stageBeforePublish === false) {
+            await params.verifyPublished?.(targetFd, verificationIdentity, parentGuard, { fd: parentFd, binding });
+        }
+        else
+            await params.verifyPublished?.(targetFd, verificationIdentity, parentGuard);
         completed = true;
         return { dev: targetIdentity.dev, ino: targetIdentity.ino };
     }

package/node_modules/@openclaw/fs-safe/dist/native-staged-file.js

@@ -177,7 +177,10 @@ class NativeStagedFile {
             }
             const identity = published.staged.identity;
             try {
-                await params.verifyPublished?.(staged.#file(), identity, parentGuard);
+                if (exclusive)
+                    await params.verifyPublished?.(staged.#file(), identity, parentGuard, { fd: parentFd, binding });
+                else
+                    await params.verifyPublished?.(staged.#file(), identity, parentGuard);
             }
             catch (error) {
                 if (params.overwrite === false && params.input.kind !== "file" && params.input.stageBeforePublish === true) {

package/node_modules/@openclaw/fs-safe/dist/permission-exec.js

@@ -5,7 +5,8 @@ import { formatErrorDetail } from "./error-detail.js";
 const execFileAsync = promisify(execFile);
 export const DEFAULT_PERMISSION_EXEC_TIMEOUT_MS = 30_000;
 export function formatPermissionErrorDetail(value) {
-    const formatted = formatErrorDetail(value);
+    // Escaping cannot shrink input; 401 code units decide the 400-character excerpt.
+    const formatted = formatErrorDetail(value.slice(0, 401));
     return formatted.length > 400 ? `${formatted.slice(0, 399)}…` : formatted;
 }
 const MAX_CAUGHT_FAILURE_PROTOTYPES = 4;

package/node_modules/@openclaw/fs-safe/dist/pinned-write-types.d.ts

@@ -2,6 +2,11 @@ import type { CopyFileInput } from "./copy-file-input.js";
 import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
 import type { MutationDirectoryObservation } from "./pinned-mutation-observation.js";
+import type { NativeBinding } from "./native-binding.js";
+export type NativeWriteParent = Readonly<{
+    fd: number;
+    binding: NativeBinding;
+}>;
 export type PinnedWriteInput = {
     kind: "buffer";
     data: string | Buffer;
@@ -64,5 +69,5 @@ export type PinnedWriteParams = {
     mutationAdmission?: PinnedWriteMutationAdmission;
     onRenameIdentityMismatch?: "verify-content";
     onPublished?: (identity: PublishedWriteIdentity) => void;
-    verifyPublished?: (fd: number, identity: PublishedWriteIdentity, parentGuard: AnyAsyncDirectoryGuard) => Promise<void>;
+    verifyPublished?: (fd: number, identity: PublishedWriteIdentity, parentGuard: AnyAsyncDirectoryGuard, nativeParent?: NativeWriteParent) => Promise<void>;
 };

package/node_modules/@openclaw/fs-safe/dist/private-temp-workspace.js

@@ -166,7 +166,7 @@ async function createTempWorkspace(options, scopedPrefix = false) {
         else
             admission.assertCurrent();
         const stat = inspectDirectoryIdentitySync(dir);
-        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode);
+        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode, dir);
         // Retain while the child still has its private creation mode so an
         // explicit dirMode such as 0 cannot make identity descriptor acquisition fail.
         retainedChild = TempWorkspaceRetainedChild.retain(dir, stat);
@@ -261,7 +261,7 @@ function createTempWorkspaceSync(options, scopedPrefix = false) {
         else {
             stat = inspectDirectoryIdentitySync(dir);
         }
-        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode);
+        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode, dir);
         retainedChild ??= TempWorkspaceRetainedChild.retain(dir, stat);
         if (needsModeInitialization) {
             retainedChild.initializeModeSync(dirMode, admission.ownerUid, admission.assertCurrent);

package/node_modules/@openclaw/fs-safe/dist/publish-file.js

@@ -1,4 +1,5 @@
-import { publishFileNoReplaceNative } from "./publish-file-native.js";
+import { nativeMoveNoReplace } from "./native-move-fallback.js";
+import { getFsSafeNativeConfig } from "./native-config.js";
 import { createHash } from "node:crypto";
 import fsSync, {} from "node:fs";
 import fs, {} from "node:fs/promises";
@@ -270,12 +271,38 @@ export async function publishFileExclusive(params) {
         }
         if (strategy === "rename-noreplace") {
             const binding = requireNativeBinding();
-            publishFileNoReplaceNative(binding, [
-                sourceNativeParent.handle.fd,
-                sourceNativeParent.basename,
-                targetNativeParent.handle.fd,
-                targetNativeParent.basename,
-            ], sourceExactIdentity, failure);
+            try {
+                const fallback = nativeMoveNoReplace(binding, [
+                    sourceNativeParent.handle.fd, sourceNativeParent.basename,
+                    targetNativeParent.handle.fd, targetNativeParent.basename,
+                ], sourceExactIdentity, getFsSafeNativeConfig().mode === "auto", "file publication");
+                if (fallback) {
+                    failure.fallback = fallback;
+                    failure.sourceRemoval = "removed";
+                }
+            }
+            catch (error) {
+                if (error instanceof FsSafeError) {
+                    if (error.details?.publication === "published") {
+                        failure.targetCreated = true;
+                        failure.preserveTarget = true;
+                        failure.phase = "rename-verify";
+                        failure.fallback = "link-unlink";
+                        failure.sourceRemoval = error.details.sourceRemoval;
+                        // Changed/unverified pairs cannot establish which inode was published.
+                        if (failure.sourceRemoval === "still-linked")
+                            rememberCreatedTarget(failure, sourceExactIdentity, "rename-verify");
+                    }
+                    throw error;
+                }
+                const code = error?.code;
+                if (code === "path-mismatch" || code === "hardlink") {
+                    throw new FsSafeError(code, "publication source changed before fallback", { cause: error });
+                }
+                if (code === "ELOOP")
+                    throw new FsSafeError("symlink", "publication source became a symlink", { cause: error });
+                throw error;
+            }
             rememberCreatedTarget(failure, sourceExactIdentity, "rename-verify");
             // A failed post-rename fence must not delete the only remaining name.
             failure.preserveTarget = true;